clnt_broadcast(3): don't free function pointers

[brooks]

Summary

Replace use of thr_getspecific/thr_setspecific to stash the function
pointer we're smuggling between clnt_broadcast and rpc_wrap_bcast with a
simple thread local variable. Clear it after use so the reference
doesn't linger.

In the relatively unlikely event clnt_broadcast was called from threads
that exited prior to program termination, the previous code called free
on a function pointer, which is undefined and might corrupted allocator
state.

Effort: CHERI upstreaming
Sponsored by: DARPA, AFRL

[brooks]

Alternatively one could avoid passing free to thr_keycreate, but the complexity of the thr_keycreate approach doesn't seem worth it to save sizeof(void *) of TLS storage.

[jhb]

I suspect the old code just predates reliable TLS support in the toolchain so was using the guts of the implementation for pthread_key.

[brooks]

In D54939#1258282, @jhb wrote:

I suspect the old code just predates reliable TLS support in the toolchain so was using the guts of the implementation for pthread_key.

The old model does have the advantage of not increasing TLS size for code that isn't commonly used. I decided to leave another half dozen or so alone for now as they involved larger structures. There is an argument that we should just convert them since I doubt it will change how many pages we need for TLS.